php中实现简单的ACL 完结篇

答案：
复制代码 代码如下:
 
-- ACL Tables 
-- 表的结构 `aclresources` 
DROP TABLE IF EXISTS `aclresources`; 
CREATE TABLE IF NOT EXISTS `aclresources` ( 
`rsid` varchar(64) NOT NULL , 
`access` int(4) NOT NULL default 0, 
`desc` varchar(240) NOT NULL default '', 
`created_at` int(10) unsigned NOT NULL default 1, 
`updated_at` int(10) unsigned NOT NULL default 0, 
PRIMARY KEY (`rsid`) 
)DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci; 
-- 表的结构 `aclroles` 
DROP TABLE IF EXISTS `aclroles`; 
CREATE TABLE IF NOT EXISTS `aclroles` ( 
`id` int(10) unsigned NOT NULL auto_increment, 
`rolename` varchar(32) NOT NULL , 
`desc` varchar(240) NOT NULL default '', 
`created_at` int(10) unsigned NOT NULL default 1, 
`updated_at` int(10) unsigned NOT NULL default 0, 
PRIMARY KEY (`id`), 
UNIQUE KEY `rolename` (`rolename`) 
)DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci; 
-- 表的结构 `ref_aclresources_aclroles` 
DROP TABLE IF EXISTS `ref_aclresources_aclroles`; 
CREATE TABLE IF NOT EXISTS `ref_aclresources_aclroles` ( 
`rsid` varchar(64) NOT NULL , 
`role_id` int(10) unsigned NOT NULL , 
PRIMARY KEY (`rsid`,`role_id`) 
)DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci; 
-- 表的结构 `ref_users_aclroles` 
DROP TABLE IF EXISTS `ref_users_aclroles`; 
CREATE TABLE IF NOT EXISTS `ref_users_aclroles` ( 
`user_id` int(10) unsigned NOT NULL auto_increment, 
`role_id` int(10) unsigned NOT NULL , 
PRIMARY KEY (`user_id`,`role_id`) 
)DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci; 
-- 表的结构 `users` 
DROP TABLE IF EXISTS `users`; 
CREATE TABLE `users` ( 
`id` int(10) unsigned NOT NULL auto_increment, 
`email` varchar(128) NOT NULL, 
`password` varchar(64) NOT NULL, 
`nickname` varchar(32) NOT NULL default '', 
`roles` varchar(240) NOT NULL default '', 
`created_at` int(10) unsigned NOT NULL default 1, 
`updated_at` int(10) unsigned NOT NULL default 0, 
PRIMARY KEY (`id`), 
UNIQUE KEY `user_email` (`email`) 
)DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci; 
 
php 类 
复制代码 代码如下:
 
<?php 
/** 
* 简单的 ACL 权限控制功能 
* 
* 表定义 
* 
* 1. 资源定义 (rsid,access,desc,created_at,updated_at) 
* 2. 角色定义 (id,rolename,desc,created_at,updated_at) 
* 3. 资源-角色关联 (rsid,role_id) 
* 4. 用户-角色关联 (user_id,role_id) 
* 
* 依赖db.php sqlobject.php 
* 
* @author vb2005xu.iteye.com 
*/ 
class AclBase { 
// --- ACL 访问授权 

/** 
* 不允许任何人访问 
*/ 
const NOBODY = 0; 

/** 
* 允许任何人访问 
*/ 
const EVERYONE = 1; 

/** 
* 允许 拥有角色的用户访问 
*/ 
const HAS_ROLE = 2; 

/** 
* 允许 不带有角色的用户访问 
*/ 
const NO_ROLE = 3; 
/** 
* 在 资源-角色关联 定义的 角色才能访问 
*/ 
const ALLOCATE_ROLES = 4; 

// 定义相关的 表名 
public $tbResources = 'aclresources'; 
public $tbRoles = 'aclroles'; 
public $tbRefResourcesRoles = 'ref_aclresources_aclroles'; 
public $tbRefUsersRoles = 'ref_users_aclroles'; 

/** 
* 格式化 资源的访问权限并返回 
* 
* @return int 
*/ 
static function formatAccessValue($access){ 
static $arr = array(self::NOBODY,self::EVERYONE,self::HAS_ROLE,self::NO_ROLE,self::ALLOCATE_ROLES); 
return in_array($access,$arr) ? $access : self::NOBODY; 
} 

/** 
* 创建资源,返回资源记录主键 
* 
* @param string $rsid 
* @param int $access 
* @param string $desc 
* 
* @return int 
*/ 
function createResource($rsid,$access,$desc){ 
if (empty($rsid)) return false; 

$resource = array( 
'rsid' => $rsid, 
'access' => self::formatAccessValue($access), 
'desc' => $desc, 
'created_at' => CURRENT_TIMESTAMP 
); 

return SingleTableCRUD::insert($this->tbResources,$resource); 
} 

/** 
* 修改资源,返回成功状态 
* 
* @param array $resource 
* @return int 
*/ 
function updateResource(array $resource){ 
if (!isset($resource['rsid'])) return false; 

$resource['updated_at'] = CURRENT_TIMESTAMP; 

return SingleTableCRUD::update($this->tbResources,$resource,'rsid'); 
} 

/** 
* 删除资源 
* 
* @param string $rsid 
* @return int 
*/ 
function deleteResource($rsid){ 
if (empty($rsid)) return false; 
return SingleTableCRUD::delete($this->tbResources,array('rsid'=>$rsid)); 
} 

/** 
* 创建角色,返回角色记录主键 
* 
* @param string $rolename 
* @param string $desc 
* 
* @return int 
*/ 
function createRole($rolename,$desc){ 
if (empty($rolename)) return false; 

$role = array( 
'rolename' => $rolename, 
'desc' => $desc, 
'created_at' => CURRENT_TIMESTAMP 
); 

return SingleTableCRUD::insert($this->tbRoles,$role); 
} 

/** 
* 修改角色,返回成功状态 
* 
* @param array $role 
* @return int 
*/ 
function updateRole(array $role){ 
if (!isset($role['id'])) return false; 

if (isset($role['rolename'])) unset($role['rolename']); 
$role['updated_at'] = CURRENT_TIMESTAMP; 

return SingleTableCRUD::update($this->tbRoles,$role,'id'); 
} 

/** 
* 删除角色 
* 
* @param int $role_id 
* @return int 
*/ 
function deleteRole($role_id){ 
if (empty($role_id)) return false; 
return SingleTableCRUD::delete($this->tbRoles,array('role_id'=>(int) $role_id)); 
} 

/** 
* 为资源指定角色,每次均先全部移除表中相关记录再插入 
* 
* @param int $rsid 
* @param mixed $roleIds 
* @param boolean $setNull 当角色id不存在时,是否将资源从关联表中清空 
*/ 
function allocateRolesForResource($rsid,$roleIds,$setNull=false,$defaultAccess=-1){ 
if (empty($rsid)) return false; 

$roleIds = normalize($roleIds,','); 
if (empty($roleIds)){ 
if ($setNull){ 
SingleTableCRUD::delete($this->tbRefResourcesRoles,array('rsid'=>$rsid)); 

if ($defaultAccess != -1){ 
$defaultAccess = self::formatAccessValue($defaultAccess); 
$this->updateResource(array('rsid'=>$rsid,'access'=>$defaultAccess)); 
} 
return true; 
} 
return false; 
} 

SingleTableCRUD::delete($this->tbRefResourcesRoles,array('rsid'=>$rsid)); 

$roleIds = array_unique($roleIds); 

foreach ($roleIds as $role_id){ 
SingleTableCRUD::insert($this->tbRefResourcesRoles,array('rsid'=>$rsid,'role_id'=>(int)$role_id)); 
} 
return true; 
} 

function cleanRolesForResource($rsid){ 
if (empty($rsid)) return false; 
return SingleTableCRUD::delete($this->tbRefResourcesRoles,array('rsid'=>$rsid)); 
} 

function cleanResourcesForRole($role_id){ 
if (empty($role_id)) return false; 
return SingleTableCRUD::delete($this->tbRefResourcesRoles,array('role_id'=>(int) $role_id)); 
} 

/** 
* 为角色分配资源,每次均先全部移除表中相关记录再插入 
* 
* @param int $role_id 
* @param mixed $rsids 
* 
* @return boolean 
*/ 
function allocateResourcesForRole($role_id,$rsids){ 
if (empty($role_id)) return false; 

$role_id = (int) $role_id; 
$rsids = normalize($rsids,','); 
if (empty($rsids)){ 
return false; 
} 

SingleTableCRUD::delete($this->tbRefResourcesRoles,array('role_id'=>$role_id)); 

$rsids = array_unique($rsids); 

foreach ($rsids as $rsid){ 
SingleTableCRUD::insert($this->tbRefResourcesRoles,array('rsid'=>$rsid,'role_id'=>$role_id)); 
} 
return true; 
} 

/** 
* 为用户指派角色,每次均先全部移除表中相关记录再插入 
* 
* 此处在用户

上一个：PHP获取MAC地址的函数代码
下一个：php中防止伪造跨站请求的小招式